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AMENDMENTS TO THE CLAIMS 
This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

1 . (Currently Amended) A method for monitoring a database, comprising: 
coll e cting submitting a first set of one or more database queries, to a database server 

that manages the database, to retrieve, from the database server, user behavior 
data that indicates hew a first set of one or more actions performed, by one or 
more users, «se as a result of the one or more users executing a first set of 
database statements against th e database; 

processing and storing the one or more sets of user behavior data as historical data^ 
said one or more sets of user behavior data including said user behavior data 
that was retrieved from the database server in response to the first set of one or 
more database queries being executed against the database : 

analyzing the historical data to determine behavior patterns; 

r e c e iving submitting a second set of one or more database queries, to the database 

server, to retrieve, from the database server, a new set of data that indicates a 
second set of one or more actions performed, by h ew the one or more users^ 
have used th e databas e as a result of the one or more users executing a second 
set of database statements against the database : 

performing a comparison between the new set of data and the determined behavior 
pattern patterns : 

determining^ based on the comparison, whether the new set of data satisfies a set of 
criteria; 

if the new set of data satisfies the set of criteria, then determining that the new set of 

data represents anomalous activity; and 
responding to the determination by performing a targeted operation. 

2. (Original) The method of claim 1 , fiirther comprising: 
determining if the new set of data violates a rule based policy; and 
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if the new set of data violates the rule based policy, then determining that the new set 
of data represents anomalous activity. 

3. (Currently Amended) The method of claim 2, wherein collecting us e r b e havior data 
submitting the first set of one or more database queries to the database server further 
comprises: 

reading information from an audit trail or dynamic performance views of [[the]] a 
database manager. 

4. (Currently Amended) The method of claim 3, wherein coll e cting us e r behavior data 
submitting the first set of one or more database queries to the database server further 
comprises coll e cting informati on submitting the first set of one or more database 
queries to the database server at a monitoring level selected from at least one of: 
information about database access for one or more selected database objects; 
information about database access for one or more selected database users; and 
information about database access for one or more selected database user sessions. 

5. (Currently Amended) The method of claim 3, wherein coll e cting us e r b e havior data 
submitting the first set of one or more database queries to the database server further 
comprises: 

receiving a type of information to be monitored; 
determining a monitoring level fi"om the type of information; and 
activating audit options of the database manager based upon the monitoring level 
determined. 

6. (Original) The method of claim 2, wherein analyzing the historical data to determine 
behavior patterns ftirther comprises: 

determining a statistical model fi-om the historical data. 
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7. (Original) The method of claim 6, wherein determining a statistical model from the 
historical data further comprises: 

determining a frequency of database access from the historical data; 
determining a probability function for frequencies of database access; and 
determining a cumulative probability function from the probability function. 



8. (Currently Amended) The method of claim 7, wherein performing a comparison 
between the new set of data and the determined behavior patt e rn patterns further 
comprises: 

testing a hypothesis using the new set of data against the statistical model. 

9. (Original) The method of claim 8, wherein testing a hypothesis using the new set of 
data against the statistical model further comprises: 

determining a frequency of database access for the new set of data; and 
determining the threshold value from a guard criteria and a probability function 
parameter. 

10. (Original) The method of claim 9, wherein testing a hypothesis using the new set of 
data against the statistical model pattern further comprises: 

comparing the frequency of database access for the new set of data with the threshold 
value. 



1 1 . (Original) The method of claim 7, wherein the historical information is about 

database access for one or more selected database objects and wherein determining a 
frequency of database access from the historical data further comprises determining a 
fi-equency of at least one of: 

object access frequency by hour of day, object access frequency by hour of day and 
operating system user, object access frequency by hour of day and database 
user, object access frequency by hour of day and location, object access 
frequency by hour of day and combination of at least two of operating system 
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user, database user and location. 



12. (Original) The method of claim 7, wherein the historical infomiation is about 

database access for one or more selected database users and wherein determining a 
frequency of database access from the historical data further comprises determining a 
frequency of at least one of: 

user access frequency by hour of day, user access frequency by hour of day and 

operating system user, user access frequency by hour of day and database user, 
user access frequency by hour of day and location, user access frequency by 
hour of day and a combination of at least two of operating system user, 
database user, and location. 



13. (Original) The method of claim 7, wherein the historical information is about 
database access for one or more selected database user sessions and wherein 
determining a frequency of database access from the historical data further comprises 
determining a frequency of at least one of: 

number of page reads per session, access duration per session, number of page reads 
per unit time. 

14. (Original) The method of claim 1 , wherein performing a targeted operation comprises 
at least one of: raising an alert; sending an email; producing a report; performing a 
visualization. 



1 5. (Currently amended) A computer-readable storage medium carrying one or more 
sequences of instructions for reverting to a recovery configuration in response to 
device faults, which instructions, when executed by one or more processors, cause the 
one or more processors to carry out the steps of: 

coll e cting submitting a first set of one or more database queries, to a database server 
that manages the database, to retrieve, from the database server, user behavior 
data that indicates hew a first set of one or more actions performed, by one or 
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more u sers, «se as a result of the one or more users executing a first set of 

database statements against t he database; 

processing and storing the one or more sets of user behavior data as historical data^ 
said one or more sets of user behavior data including said user behavior data 
that was retrieved fi-om the database server in response to the first set of one or 
more database queries being executed against the database : 

analyzing the historical data to determine behavior patterns; 

receiving submitting a second set of one or more database queries, to the database 

server, to retrieve, from the database server, a new set of data that indicates a 
second set of one or more actions performed, by h ew the one or more users^ 
havo used th e databas e as a result of the one or more users executing a second 
set of database statements against the database ; 

performing a comparison between the new set of data and the determined behavior 
pattern patterns ; 

determining based on the comparison, whether the new set of data satisfies a set of 
criteria; 

if the new set of data satisfies the set of criteria, then determining that the new set of 

data represents anomalous activity; and 
responding to the determination by performing a targeted operation, 

16. (Currently Amended) The computer-readable storage medium of claim 15, fiirther 
comprising instructions which, when executed by the one or more processors, cause 
the one or more processors to carry out the steps of: 

determining if the new set of data violates a rule based policy; and 
if the new set of data violates the rule based policy, then determining that the new set 
of data represents anomalous activity. 

17. (Currently Amended) The computer-readable storage m edium of claim 16, wherein 
the instructions for carrying out the step of collecting us e r b e havior data submitting 
the first set of one or more database queries to the database server further comprise 
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instructions for carrying out the step of: 

reading information from an audit trail of the database manager. 

1 8. (Currently Amended) The computer-readable storage m edium of claim 1 7, wherein 
the instructions for carrying out the step of collecting user behavior data submitting 
the first set of one or more database queries to the database server further comprise 
instructions for carrying out the step of coll e cting information submitting the first set 
of one or more database queries to the database server at a monitoring level selected 
from at least one of: 

information about database access for one or more selected database objects; 
information about database access for one or more selected database users; and 
information about database access for one or more selected database user sessions. 

19. (Currently Amended) The computer-readable storage medium of claim 17, wherein 
the instructions for carrying out the step of coll e cting user b e havior data submitting 
the first set of one or more database queries to the database server further comprise 
instructions for carrying out the steps of: 

receiving a type of information to be monitored; 
determining a monitoring level from the type of information; and 
activating audit options of the database manager based upon the monitoring level 
determined. 

20. (Currently Amended) The computer-readable storage medium of claim 16, wherein 
the instructions for carrying out the step of analyzing the historical data to determine 
behavior patterns further comprise instructions for carrying out the step of: 
determining a statistical model from the historical data. 

2 1 . (Currently Amended) The computer-readable storage m edium of claim 20, wherein 
the instructions for carrying out the step of determining a statistical model from the 
historical data further comprise instructions for carrying out the step of: 
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determining a frequency of database access from the historical data; 
determining a probability function for frequencies of database access; and 
determining a cumulative probability function from the probability function. 

22. (Currently Amended) The computer-readable storage medium of claim 2 1 , wherein 
the instructions for carrying out the step of performing a comparison between the new 
set of data and the determined behavior patt e rn patterns further comprise instructions 
for carrying out the step of: 

testing a hypothesis using the new set of data against the statistical model. 

23. (Currently Amended) The computer-readable storage medium of claim 22, wherein 
the instructions for carrying out the step of testing a hypothesis using the new set of 
data against the statistical model further comprise instructions for carrying out the 
steps of: 

determining a frequency of database access for the new set of data; and 
determining the threshold value from a guard criteria and a probability function 
parameter. 

24. (Currently Amended) The computer-readable storage medium of claim 23, wherein 
the instructions for carrying out the step of testing a hypothesis using the new set of 
data against the statistical model further comprise instructions for carrying out the 
step of: 

comparing the frequency of database access for the new set of data with the threshold 
value. 

25. (Currently Amended) The computer-readable storage medium of claim 2 1 , wherein 
the historical information is about database access for one or more selected database 
objects and wherein the instructions for carrying out the step of determining a 
frequency of database access from the historical data further comprise instructions for 
carrying out the step of determining a frequency of at least one of: 
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object access frequency by hour of day, object access frequency by hour of day and 
operating system user, object access frequency by hour of day and database 
user, object access frequency by hour of day and location and object access 
frequency by hour of day and a combination of at least two of operating 
system user, database user and location. 



26. (Currently Amended) The computer readable storage medium of claim 21 , wherein 
the historical information is about database access for one or more selected database 
users and wherein the instructions for carrying out the step of determining a frequency 
of database access from the historical data further comprise instructions for carrying 
out the step of determining a frequency of at least one of: 
user access frequency by hour of day, user access frequency by hour of day and 

operating system user, user access frequency by hour of day and database user, 
user access frequency by hour of day and location and user access frequency 
by hour of day and a combination of at least two of operating system user, 
database user, and location. 



27. (Currently Amended) The computer readable storage medium of claim 21 , wherein 
the historical information is about database access for one or more selected database 
user sessions and wherein the instructions for carrying out the step of determining a 
frequency of database access from the historical data further comprise instructions for 
carrying out the step of determining a frequency of at least one of: 

number of page reads per session, access duration per session, number of page reads 
per unit time. 

28. (Currently Amended) The computer readable storage m edium of claim 15, wherein 
the instructions for carrying out the step of performing a targeted operation comprises 
comprise instructions for carrying out at least one of: raising an alert; sending an 
email; producing a report; performing a visualization. 
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29. (Currently amended) An apparatus, comprising: 

means fo r collecting submitting a first set of one or more database queries, to a 
database server that manages the database, to retrieve, from the database 
server, u ser behavior data that indicates hew a first set of one or more actions 
performed, by one or more users, «se as a resuh of the one or more users 
executing a first set of database statements against th e database; 

means for processing and storing the one or more sets of user behavior data as 

historical data , said one or more sets of user behavior data including said user 
behavior data that was retrieved from the database server in response to the 
first set of one or more database queries being executed against the database ; 

means for analyzing the historical data to determine behavior patterns; 

means fo r r e c e iving submitting a second set of one or more database queries, to the 
database server, to retrieve, from the database server, a new set of data that 
indicates a second set of one or more actions performed, by hew the one or 
more users^ hav e us e d the databas e as a result of the one or more users 
executing a second set of database statements against the database ; 

means for performing a comparison between the new set of data and the determined 
behavior patt e rn patterns ; 

means for determining based on the comparison, whether the new set of data satisfies 
a set of criteria; 

means for determining that the new set of data represents anomalous activity, if the 

new set of data satisfies the set of criteria; and 
means for responding to the determination by performing a targeted operation. 

30. (Currently amended) An apparatus, comprising: 

a data collector for (a) collecting user behavior data that indicates hew a first set of 
one or more actions performed, by one or more users , as a result of the one or 
more users executing a first set of database statements against use the 
database^ md (h) processing and storing the one or more sets of user behavior 
data as historical dat a, said one or more sets of user behavior data including 
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said user behavior data that was retrieved from the database server in response 
to the first set of one or more database queries being executed against the 
database. [[;]] and (c) r e c e iving submitting a second set of one or more 
database queries, to the database server, to retrieve, from the database server, a 
new set of data that indicates hew a second set of one or more actions 
performed, by the o ne or more users , as a resuh of the one or more users 
executing a second set of database statements against hav e us e d the database; 
a data analyzer for analyzing the historical data to determine behavior patterns; and 
an anomaly detector for (a) performing a comparison between the new set of data and 
the determined behavior pattern -patterns, rr;11 (b) determining^ based on the 
comparison, whether the new set of data satisfies a set of criteria^ [[;]] (c} 
determining that the new set of data represents anomalous activity if the new 
set of data satisfies the set of criteria^ [[;]] and (d) responding to the 
determination by performing a targeted operation. 
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